d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/ZCB.dll
Size

3.6MB
MD5

679820559727944c864d3bdd4768a43f
SHA1

1fdbf2bc3e3b3134a7c6ffe4274651a872a829e5
SHA256

920c57348a1a1925c7ade23f27eba93eb84827c39381306423a02cbb79a4dfa6
SHA512

40db0fe36df37859d1a78da477ba9967cae93dccaf2caa07bd895c4a73bab019b71038569e3b17cb9b09350b79fe2199fc6bbba23a79ff4017072965b94b3e38
SSDEEP

98304:1p3WJuWVDybvrIWsfZkhrLCujyTf2cA0V:1RWsbUWsfyK2ct

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral7/memory/2192-0-0x00000000740F0000-0x0000000074943000-memory.dmp	vmprotect
behavioral7/memory/2192-1-0x00000000740F0000-0x0000000074943000-memory.dmp	vmprotect

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID\ = "REGCOM.Register"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\ = "ZCBLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID\ = "{FDADFBD5-B162-42D3-AC79-21C88F8888BE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID\ = "REGCOM.Register.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\\ZCB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\乐刷助手(淘宝小号管理，拍单助手) 2.1.9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28
PID 2140 wrote to memory of 2192	2140	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\ZCB.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\ZCB.dll"
  2⤵
  - Modifies registry class
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x00000000740F0000-0x0000000074943000-memory.dmp

Filesize
8.3MB

Download
memory/2192-1-0x00000000740F0000-0x0000000074943000-memory.dmp

Filesize
8.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads